MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be0058939e80bd38210c00ad3ae2358f55006c3ed4bbcb7cb59b9e46e96c5cfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be0058939e80bd38210c00ad3ae2358f55006c3ed4bbcb7cb59b9e46e96c5cfe
SHA3-384 hash: 1cb1ecc7867e9df23bc02f2d496a4365a569596927ca4fa45d2f9329872b8e2a2db904cdfc9d882ac39649a4542d679e
SHA1 hash: ef36fdcc00b217535484818c4bf156542c20856d
MD5 hash: 855bb4cffa83b1ba64e862d3c8abdb9e
humanhash: video-twelve-three-speaker
File name:pops.works_manahet__1390ab4nu59ok.exe.malw
Download: download sample
Signature TrickBot
Create hunting rule
File size:496'147 bytes
First seen:2020-06-16 22:00:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b23b9ad9f12b8fc28e61bff35382e32 (1'240 x TrickBot)
ssdeep 6144:uXKJlnagpOWod1+3Ea6dDeCR7yaEnC+lbUGhclavUr1M5Hs+cI9/:rpwYGRb+lbUqcl2Ur25Hs5It
Threatray 2'868 similar samples on MalwareBazaar
TLSH 12B449C6A19643BBEE8766FF358AC55DBC13D91C1B4DB4FBC789AA020A31B05ED12350
Reporter ov3rflow1
Tags:malw TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11266/
Detection(s):
SecuriteInfo.com.BScope.Backdoor.Emotet.14181.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 22:02:14 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
01b6f841d5c477494b7cfa366442fa86e062b0274241df3c6ab10f769f10c02f
TrickBot
0b5f544aee9ef5a7bcbdcfddcc59088d75241dc7b55bf4294441521702721022
TrickBot
233b853881af102172d183314376d9ac05aed87d38651debd0876044e460b26f
TrickBot
287323c3b6e49160183991b6d1ebb5f4741064c139db1467e30d078d6e7693d5
TrickBot
31aa48f9ad497574a3586314f7f4eeca5318e849ec4eda53c7f776b7800c4e96
TrickBot
3505ad230c6e2c45ae8a6ed01fa1d327b9d888678d0aa2f3e985abcd48c9c990
TrickBot
63ff876ba9d2655d07ba11ca13096265f88d6848aabaa1b59795030aaed22a68
TrickBot
d1f2a29b27e6e45ae3c7d4fff464cbf832c4348fcb37ce931f4edab56512fd4c
TrickBot
e115e6a5265c115432fc4be5886252e24de7ad91389c7de9618a5c6de235f628
TrickBot
efb08c299bdb130886b43c154ab2d254d3e38161d960396f9fb307dd1f1a4039
TrickBot
+ 2'858 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200624-kkvkyetx9n/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Trickbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/11266/

Comments